Provider authentik

Provider: authentik

Prerequisites

• authentik running and accessible
• An OAuth2/OIDC Provider and Application configured in authentik

authentik Configuration

Create an OAuth2/OIDC Provider

1. Go to Admin Interface → Applications → Providers → Create.
2. Select OAuth2/OpenID Provider.
3. Configure:
   • Name: Jellyfin
   • Authorization flow: your preferred flow
   • Client type: Confidential
   • Redirect URIs: https://<your-jellyfin-domain>/sso/OID/redirect/authentik
   • Scopes: openid, profile, email, offline_access
4. Note the Client ID and Client Secret.

Create an Application

1. Go to Admin Interface → Applications → Applications → Create.
2. Set the provider to the one created above.
3. Set the slug (e.g., jellyfin).

Configure Group Claims (for RBAC)

1. Edit the provider and go to Advanced Protocol Settings.
2. Add a Property mapping that exposes groups as a claim named groups.

authentik ships with a default groups mapping. If it is not already selected, add it to the provider's Property Mappings.

Jellyfin Plugin Configuration

Field	Value
Provider Name	authentik
OpenID Endpoint	https://<authentik-domain>/application/o/<app-slug>/
Client ID	from authentik provider
Client Secret	from authentik provider
Role Claim	groups
Request Additional Scopes	(none required if groups mapping is active)

RBAC Configuration

Set Roles to the authentik group names allowed to log in:

jellyfin-users

Set Admin Roles to groups that receive admin access:

jellyfin-admins

Redirect URI

https://<your-jellyfin-domain>/sso/OID/redirect/authentik